How Malware Gets In: From Floppy Disks to Fake Downloads
Where you are: Unit V — Machines and Networks Under Attack · Lesson 5.3 (Section 5A — Malware: How Devices Are Attacked) · This lesson follows Chapter 15 of Dr. Al-Doori's Cyber Security Essentials.
Lesson 5.1 sorted malware by what it is and what it does. This lesson asks a more practical question: how does it get onto your device in the first place? Dr. Al-Doori's starting point is simple and still true. Malware has to get in somehow, and every way in can be closed by a habit. If you know the doors, you can lock them.
What you'll be able to do
Identify today's most common infection routes and the habit that closes each one. By the end of this lesson you will be able to:
- explain how the classic routes (disks, downloads, attachments, infected websites) still shape today's attacks;
- recognize the modern routes: fake installers and AI tools, search-ad lures, malicious browser extensions and "paste this command" tricks;
- match each route to the one habit that closes it.
Where It All Began: Elk Cloner
Dr. Al-Doori opens the chapter with Elk Cloner, a program from 1982 that spread between Apple II computers on floppy disks. An infected disk infected the computer; the computer then infected every clean disk put into it; and friends sharing disks carried it onward.
Most historians count Elk Cloner as the first computer virus, and the first to affect personal computers, as The Register noted on its 25th anniversary. Some point instead to an earlier self-copying program called Creeper, detected on ARPANET, the research network that came before the Internet. Either way, Elk Cloner shows the pattern the book highlights: infected media plus human sharing. The floppy disk is gone, but the pattern is not. Most modern infections still need a person to carry something in: a file, an app or a command.
The Doors, Then and Now
The book lists the main routes malware uses. Some have changed a lot since it was written; others have barely changed. Here they are with the habit that closes each one.
| Route | How it works | The habit that closes it |
|---|---|---|
| Removable media (USB drives, memory cards) | Windows no longer launches programs automatically from USB drives, so the risk is you opening a file on an unknown drive. | Don't plug in drives you found or were handed unexpectedly; don't open files from drives you don't trust. |
| Downloads and fake installers | Criminals publish fake versions of popular apps, including fake AI tools, that install malware alongside, or instead of, the real thing. | Get software only from your device's official app store or the maker's own site, reached by typing the address or using a bookmark. |
| Search-ad lures | The top result when you search for a program can be a paid advert pointing to a look-alike site. | Skip ads in search results and check the real domain before downloading (Lesson 2.3). |
| Malicious browser extensions | Add-ons can see what you do in your browser. A harmful one can watch, change pages or steal data. | Install only extensions you really need, from the browser's official store; remove ones you no longer use. |
| Email attachments and links | Opening an attachment or link can run malicious code, even from someone you know. | Verify unexpected files through another channel before opening (Lesson 3.2). |
| Drive-by downloads and malicious ads | Visiting a compromised page, or one showing a poisoned advert, can trigger a download with little or no clicking. | Keep your browser and system updated automatically (Lesson 5.4). |
| Network worms | Worms move between machines by exploiting software that has not been updated. | Automatic updates and the built-in firewall switched on. |
| Pop-ups and fake "fix it" prompts | Fake warnings urge you to install a "fix", call a "support" number, or paste a command to "verify you are human". | Never install, call or paste because a pop-up told you to. Close the tab (Lesson 3.3). |
Notice how many habits repeat: get software from the source, keep everything updated, and don't let a web page give you instructions. Those three cover most of the table.
Today's Busiest Doors: You Do the Installing
The biggest change since the book was written is that criminals now rely less on breaking in and more on persuading you to let them in.
Fake installers and fake AI tools. When a new tool becomes popular, fake versions appear quickly. Microsoft Threat Intelligence has documented infostealers on both Windows and macOS delivered through fake installers. A download that promises a free version of something normally paid for deserves extra suspicion.
"Paste this command" tricks. A technique Microsoft calls ClickFix shows a fake error or a fake "I'm not a robot" check, then tells you to copy a command and paste it into a system tool to "fix" or "verify" something. The pasted command installs malware, and you are the one who runs it. The European Union Agency for Cybersecurity (ENISA) described this technique as prevalent in 2025. Lesson 3.3 teaches how to spot these pages; the rule to remember here is short: no real website needs you to paste a command.
Fake support pop-ups. Some pop-ups don't install anything themselves; they tell you to phone a "support" line that is run by scammers. The FBI's 2025 Internet Crime Report recorded about $2.13 billion in reported losses to tech-support scams in the US alone.
Real-World Example
Imagine Omar, a university student, wants a popular AI video editor. He searches for it, and the first result, marked as an advert, leads to a polished site with a big "Free download" button. The installer works, and the editor even opens. What Omar doesn't see is the infostealer installed alongside it, which quietly copies the passwords and login cookies saved in his browser. A week later, his email and a social media account are taken over.
Three habits from the table would each have stopped this: skipping the advert, checking that the domain was the maker's real one, and downloading from the official app store or the maker's own site instead.
From the Book to 2026
What the book teaches. Dr. Al-Doori introduces Elk Cloner as the first computer virus and lists the common sources of malware: removable media that can load code as soon as it is connected, downloads, network worms, attachments, drive-by downloads, pop-ups and malicious ads. His key habits are caution about what you plug in or download, and prompt patching.
Why it made sense. When the original text was written, Windows could launch programs from removable media automatically, so a USB drive really could infect a computer as soon as it was plugged in.
What has changed. Security guidance has evolved since the original text. Microsoft restricted AutoRun so that, since an automatic update in February 2011, Windows no longer launches programs from USB drives on its own (Microsoft Security Advisory 967940). An exception remains for devices that pretend to be CD drives, so unknown drives still deserve caution. Elk Cloner is usually described as the first virus to affect personal computers, while some historians point to the earlier Creeper program on ARPANET. And new routes have joined the list: fake installers and AI tools, search-ad lures, malicious extensions and "paste this command" pages.
What to do now. The book's two habits still hold. Current guidance now recommends adding a third: never follow instructions from a web page or pop-up to install, call or paste anything.
What Would You Do?
While searching for a free PDF converter, you land on a site that shows a box: "Verify you are human. Press the keys shown, then paste the code into the Run box and press Enter." The page looks professional and the converter is exactly what you need. What do you do, and why?
Knowledge Check
You find a USB drive labelled Exam Answers on a library desk. Windows no longer auto-runs USB drives. What is the safest choice?
You search for a popular free app and the first result is an advert for a site you don't recognize. What should you do?
A browser extension you installed last year asks for new permission to read and change data on all websites. You rarely use it. Best action?
Answers explained
What Would You Do? Close the tab without pressing or pasting anything. This is the "paste this command" trick described above: real verification checks never ask you to run anything on your own computer, and pasting the code would install malware with your own hands. Find a converter in your device's official app store or from a well-known maker's own site. If you already pasted a command, disconnect, run a full scan with your built-in protection, and follow Lesson 6.1 for your accounts.
Question 1 — d. A found drive labelled to arouse curiosity is a classic lure, so the safest choice is not to plug it in at all. AutoRun being restricted (a) removes one risk, not all: a drive can pretend to be a CD drive. Opening the document (b) is exactly the action the lure wants. A friend's computer (c) just moves the risk to someone else.
Question 2 — c. Search adverts can point to look-alike sites, and going to the source closes that door. Being the top result (a) only means someone paid for the spot. A padlock (b) shows the connection is encrypted, not that the site is honest (Lesson 5.7). Scanning afterwards (d) comes too late, because the installer has already run, and no scan catches everything.
Question 3 — a. An extension you barely use, asking for broad new access to every website, is a risk with no benefit; fewer extensions mean fewer doors. Updates (b) do not normally require far wider permissions. Clearing cookies (c) does not limit what the extension can see afterwards. Ignoring the request (d) keeps an unneeded add-on installed.
Key Takeaways
- Elk Cloner (1982) shows a pattern that still holds: infected media plus human sharing. Most infections still need a person to carry something in.
- Windows has not auto-run programs from USB drives since 2011, but unknown drives and files still deserve caution.
- Today's busiest doors are fake installers and AI tools, search-ad lures, malicious extensions and "paste this command" pages.
- Three habits close most doors: get software from the source, keep everything updated, and never let a web page tell you to install, call or paste.
Sources
- Microsoft — Security Advisory 967940: Update for Windows Autorun
- Microsoft Threat Intelligence — Think before you Click(Fix): Analyzing the ClickFix social engineering technique (2025)
- Microsoft Threat Intelligence — Infostealers without borders: macOS, Python stealers, and platform abuse (2026)
- ENISA — Threat Landscape 2026
- FBI Internet Crime Complaint Center — 2025 IC3 Annual Report (data)
- The Register — Computer virus turns 25 (July 2007)
- Dr. Tahseen Al-Doori — Cyber Security Essentials, Chapter 15